<html>
<head><meta charset="utf-8"><title>Miri allows accessing a field of an uninitialized struct · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html">Miri allows accessing a field of an uninitialized struct</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="204431084"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204431084" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204431084">(Jul 20 2020 at 14:45)</a>:</h4>
<p>This code doesn't report Miri warnings, but I thought it would because we are dereferencing a field of an uninitialized struct:</p>
<div class="codehilite"><pre><span></span><code><span class="cp">#[derive(Debug)]</span><span class="w"></span>
<span class="k">struct</span> <span class="nc">Test</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">a</span>: <span class="kt">i64</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="n">b</span>: <span class="kp">&amp;</span><span class="nb">&#39;static</span><span class="w"> </span><span class="kt">str</span><span class="p">,</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>

<span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">use</span><span class="w"> </span><span class="n">std</span>::<span class="n">alloc</span>::<span class="p">{</span><span class="n">alloc</span><span class="p">,</span><span class="w"> </span><span class="n">dealloc</span><span class="p">,</span><span class="w"> </span><span class="n">Layout</span><span class="p">};</span><span class="w"></span>

<span class="w">    </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">layout</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">Layout</span>::<span class="n">new</span>::<span class="o">&lt;</span><span class="n">Test</span><span class="o">&gt;</span><span class="p">();</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">ptr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">alloc</span><span class="p">(</span><span class="n">layout</span><span class="p">)</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">Test</span><span class="p">;</span><span class="w"></span>

<span class="w">        </span><span class="p">(</span><span class="o">*</span><span class="n">ptr</span><span class="p">).</span><span class="n">a</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">42</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="p">(</span><span class="o">*</span><span class="n">ptr</span><span class="p">).</span><span class="n">b</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="s">&quot;testing&quot;</span><span class="p">;</span><span class="w"></span>

<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">bx</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">Box</span>::<span class="n">from_raw</span><span class="p">(</span><span class="n">ptr</span><span class="p">);</span><span class="w"></span>

<span class="w">        </span><span class="n">println</span><span class="o">!</span><span class="p">(</span><span class="s">&quot;{:?}&quot;</span><span class="p">,</span><span class="w"> </span><span class="n">bx</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>


<p>I thought this was one of the reasons that raw references needed to be added; what piece am I missing?</p>



<a name="204431469"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204431469" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204431469">(Jul 20 2020 at 14:48)</a>:</h4>
<p>You are initializing the data though?</p>



<a name="204431507"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204431507" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204431507">(Jul 20 2020 at 14:48)</a>:</h4>
<p>If you remove one of the assignments it complains</p>



<a name="204431537"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204431537" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204431537">(Jul 20 2020 at 14:48)</a>:</h4>
<p>I think this is fine because both <code>a</code> and <code>b</code> don't implement drop</p>



<a name="204431596"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204431596" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204431596">(Jul 20 2020 at 14:49)</a>:</h4>
<p>so doing the same with <code>b: String</code> is definitely unsound</p>



<a name="204431654"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204431654" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204431654">(Jul 20 2020 at 14:49)</a>:</h4>
<p>hm I would've personally expected an error on the <code>(*ptr).a</code> as I would expect that to create a <code>&amp;mut Test</code> before going to the field. Maybe we special case something there though?</p>



<a name="204431726"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204431726" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204431726">(Jul 20 2020 at 14:50)</a>:</h4>
<p>miri doesn't look into references rn afaik</p>



<a name="204432042"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204432042" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204432042">(Jul 20 2020 at 14:52)</a>:</h4>
<p>this is currently also "allowed" by miri:</p>
<div class="codehilite"><pre><span></span><code><span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">x</span>: <span class="kt">u8</span> <span class="o">=</span><span class="w"> </span><span class="mi">3</span><span class="p">;</span><span class="w"></span>

<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">y</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">z</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">bool</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="o">*</span><span class="p">(</span><span class="n">y</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="kt">u8</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="kt">bool</span><span class="p">)</span><span class="w"> </span><span class="p">};</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="204432430"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204432430" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204432430">(Jul 20 2020 at 14:55)</a>:</h4>
<p>there is an open discussion about this in <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/77">https://github.com/rust-lang/unsafe-code-guidelines/issues/77</a></p>



<a name="204435591"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204435591" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204435591">(Jul 20 2020 at 15:19)</a>:</h4>
<p><span class="user-mention silent" data-user-id="116122">simulacrum</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct/near/204431654">said</a>:</p>
<blockquote>
<p>hm I would've personally expected an error on the <code>(*ptr).a</code> as I would expect that to create a <code>&amp;mut Test</code> before going to the field. Maybe we special case something there though?</p>
</blockquote>
<p>Yes, this was my main point — and why I brought up raw references.</p>



<a name="204437687"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204437687" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204437687">(Jul 20 2020 at 15:34)</a>:</h4>
<p>Pivoting a bit, <strong>is</strong> it well-defined to access the field of an undefined struct without using raw references?</p>



<a name="204437945"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204437945" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204437945">(Jul 20 2020 at 15:36)</a>:</h4>
<p>I think overwriting undefined values of types not implementing drop will have to remain ub free, considering how frequently it is used in the wild</p>



<a name="204437991"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204437991" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204437991">(Jul 20 2020 at 15:37)</a>:</h4>
<p>instead of the more correct <code>ptr::write</code></p>



<a name="204438020"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204438020" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204438020">(Jul 20 2020 at 15:37)</a>:</h4>
<p>related: <a href="https://without.boats/blog/two-memory-bugs-from-ringbahn/">https://without.boats/blog/two-memory-bugs-from-ringbahn/</a></p>



<a name="204438239"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204438239" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204438239">(Jul 20 2020 at 15:39)</a>:</h4>
<p>not that I am too knowledgeable about this btw <span aria-label="sparkles" class="emoji emoji-2728" role="img" title="sparkles">:sparkles:</span></p>



<a name="204438644"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204438644" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204438644">(Jul 20 2020 at 15:41)</a>:</h4>
<p><span class="user-mention" data-user-id="216206">@lcnr</span> then I don't understand the motivation for <a href="https://rust-lang.github.io/rfcs/2582-raw-reference-mir-operator.html">the raw reference operator</a>.</p>



<a name="204438777"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204438777" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204438777">(Jul 20 2020 at 15:42)</a>:</h4>
<p>iirc the problem was <code>#[repr(packed)]</code> which would mean that references to struct fields are unaligned, which is ub</p>



<a name="204438850"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204438850" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204438850">(Jul 20 2020 at 15:43)</a>:</h4>
<p>so referencing a field, even using <code>&amp;mut packed.field as *mut _</code> would temporarily have an unaligned reference, which is UB</p>



<a name="204438902"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204438902" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204438902">(Jul 20 2020 at 15:43)</a>:</h4>
<p>like, I'm mostly asking about </p>
<div class="codehilite"><pre><span></span><code><span class="w">    </span><span class="p">(</span><span class="o">*</span><span class="n">ptr</span><span class="p">).</span><span class="n">a</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">42</span><span class="p">;</span><span class="w"></span>
<span class="c1">//  ^^^^^^^^ ^^^^</span>
<span class="c1">//  |           |</span>
<span class="c1">//  + This part |</span>
<span class="c1">//              + Not this part</span>
</code></pre></div>



<a name="204439122"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204439122" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204439122">(Jul 20 2020 at 15:45)</a>:</h4>
<p>ok, so now I am mostly making things up, but I think that <code>(*ptr).a</code> is only a <em>place</em>, not a <em>value</em>, so as long as <code>ptr</code> points to an existing address this should be fine</p>



<a name="204439194"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204439194" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204439194">(Jul 20 2020 at 15:45)</a>:</h4>
<p>please wait for someone else to approve this though, I am not sure about that</p>



<a name="204439865"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204439865" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204439865">(Jul 20 2020 at 15:51)</a>:</h4>
<p>My UB guru is off on a week-long vacation.</p>



<a name="204458742"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204458742" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204458742">(Jul 20 2020 at 18:35)</a>:</h4>
<p>Another reason for raw references is if you want to write field by field, you can't do that right now without UB (creating a reference to uninit data)</p>



<a name="204460667"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204460667" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204460667">(Jul 20 2020 at 18:52)</a>:</h4>
<p><span class="user-mention silent" data-user-id="249222">Elichai Turkel</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct/near/204458742">said</a>:</p>
<blockquote>
<p>Another reason for raw references is if you want to write field by field, you can't do that right now without UB (creating a reference to uninit data)</p>
</blockquote>
<p>now I'm more confused. Isn't that <em>literally</em> what this code is doing?</p>
<div class="codehilite"><pre><span></span><code><span class="w">        </span><span class="p">(</span><span class="o">*</span><span class="n">ptr</span><span class="p">).</span><span class="n">a</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">42</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="p">(</span><span class="o">*</span><span class="n">ptr</span><span class="p">).</span><span class="n">b</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="s">&quot;testing&quot;</span><span class="p">;</span><span class="w"></span>
</code></pre></div>



<a name="204461525"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204461525" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204461525">(Jul 20 2020 at 18:58)</a>:</h4>
<p>well I think the point is that we'll have magical syntax for "field level access" without ever creating a reference</p>



<a name="204461576"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204461576" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204461576">(Jul 20 2020 at 18:59)</a>:</h4>
<p>I don't know how to exactly express it though</p>



<a name="204462282"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204462282" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204462282">(Jul 20 2020 at 19:04)</a>:</h4>
<p>That feels like it's in agreement with what I'm trying to say. If this code used raw references, I'd expect that it wouldn't be UB (at least for these two lines). Since it doesn't use raw references, I feel like it <strong>is</strong> UB.</p>



<a name="204462349"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204462349" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204462349">(Jul 20 2020 at 19:04)</a>:</h4>
<p>Agreed, yeah -- I think miri just isn't catching this for whatever reason</p>



<a name="204462526"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204462526" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204462526">(Jul 20 2020 at 19:05)</a>:</h4>
<p>Sure, and that may be the Miri limitation linked above.</p>



<a name="204464657"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204464657" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204464657">(Jul 20 2020 at 19:23)</a>:</h4>
<p>What I mean is that even though it's under debate and currently not checked by miri, your ( <span class="user-mention" data-user-id="116155">@Jake Goulding</span>) code does exhibit UB</p>



<a name="204464757"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204464757" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204464757">(Jul 20 2020 at 19:24)</a>:</h4>
<p>Only now got your response, weird.<br>
But yeah it's a miri limitation AFAIK</p>



<a name="204510930"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204510930" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204510930">(Jul 21 2020 at 04:10)</a>:</h4>
<p><span class="user-mention silent" data-user-id="116155">Jake Goulding</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct/near/204460667">said</a>:</p>
<blockquote>
<p>now I'm more confused. Isn't that <em>literally</em> what this code is doing?</p>
</blockquote>
<div class="codehilite"><pre><span></span><code><span class="w">        </span><span class="p">(</span><span class="o">*</span><span class="n">ptr</span><span class="p">).</span><span class="n">a</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">42</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="p">(</span><span class="o">*</span><span class="n">ptr</span><span class="p">).</span><span class="n">b</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="s">&quot;testing&quot;</span><span class="p">;</span><span class="w"></span>
</code></pre></div>


<p>It's not. Here's a concrete example: <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=b84a0bbefb1e2a47087f6b30e85efa67">https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=b84a0bbefb1e2a47087f6b30e85efa67</a></p>
<div class="codehilite"><pre><span></span><code><span class="k">fn</span> <span class="nf">value</span><span class="p">(</span><span class="n">s</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="o">&amp;</span><span class="nb">&#39;static</span><span class="w"> </span><span class="kt">str</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">o</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="s">&quot;test&quot;</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="o">*</span><span class="n">s</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">o</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>


<p>If you look at MIR note that there isn't even a read of <code>_1</code>, the argument. I'm not completely sure if that is indeed a stable detail of the semantics of assignment of non-<code>Drop</code> values but it is the effective current semantics which are defined through MIR. If you change the type behind the pointer to <code>String</code> yourself you will also see that <code>_1</code> is dropped in-place before being overwritten, not swapped and then dropped. That is sound since panics in Drop will abort and so either the assignment is reached or we abort. For no-<code>Drop</code>, no reference is created for the assignment target.</p>



<a name="204533581"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204533581" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204533581">(Jul 21 2020 at 10:51)</a>:</h4>
<p><span class="user-mention" data-user-id="229913">@HeroicKatora</span> your new example does not access a field of an uninitialized value, so I’m not following how it relates to my question</p>



<a name="204533689"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204533689" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204533689">(Jul 21 2020 at 10:52)</a>:</h4>
<p><code>s</code> might as well be pointing to uninitialized memory. It's the same if the pointee is directly uninitialized or if its a field of a larger uninitialized struct.</p>



<a name="204533733"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204533733" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204533733">(Jul 21 2020 at 10:53)</a>:</h4>
<p>The place expressions <code>(*ptr).a</code> has the exact same requirements as if you had a pointer to <code>a</code> directly and dereferenced that.</p>



<a name="204533859"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204533859" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204533859">(Jul 21 2020 at 10:54)</a>:</h4>
<p><a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=dd74fb4ea4a4b4e6981b1293b6d9d3f7">https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=dd74fb4ea4a4b4e6981b1293b6d9d3f7</a><br>
Here, with a struct and field. Same thing</p>



<a name="204535931"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204535931" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204535931">(Jul 21 2020 at 11:24)</a>:</h4>
<p><span class="user-mention silent" data-user-id="249222">Elichai Turkel</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct/near/204458742">said</a>:</p>
<blockquote>
<p>Another reason for raw references is if you want to write field by field, you can't do that right now without UB (creating a reference to uninit data)</p>
</blockquote>
<p><span class="user-mention" data-user-id="229913">@HeroicKatora</span>  does that mean you disagree with this statement <span aria-label="point up" class="emoji emoji-1f446" role="img" title="point up">:point_up:</span> ?</p>
<p>I do think we are getting into the terminology here though. You said</p>
<p><span class="user-mention silent" data-user-id="229913">HeroicKatora</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct/near/204510930">said</a>:</p>
<blockquote>
<p>I'm not completely sure if that is indeed a stable detail of the semantics of assignment of non-<code>Drop</code> values</p>
</blockquote>
<p>Because it's not a "stable detail", by <em>definition</em> it must be undefined behavior, right? It just so happens that <strong>in this case at this point in time</strong> it doesn't cause a problem.</p>



<a name="204536092"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204536092" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204536092">(Jul 21 2020 at 11:26)</a>:</h4>
<p>Yes, I do disagree with that statement.<br>
This is actually kind of important: If no auto-deref is involved, <code>(*ptr).a</code> is not really concerned with the whole place <code>*ptr</code>, it constructs neither a reference to it, nor requires it to be valid, its sole use is in finding the proper memory address of the complete referred place with size of field <code>a</code>. Otherwise <code>struct.field</code>, which is implicitly <code>(*struct).field</code>, would always borrow the whole struct but it obviously does not. (edit: deleted some stacked borrows stuff that I don't know for sure).<br>
The raw pointer syntax is for getting a pointer to <code>(*ptr).a</code> that can be stored somewhere. This is currently not possible since for that you must convert the place expression to a value which you can only do by using it in a reference expression <code>&amp;(*ptr).a</code> and coercing that reference.</p>



<a name="204536199"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204536199" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204536199">(Jul 21 2020 at 11:28)</a>:</h4>
<p>The thing where I'm not sure (I didn't say it's not stable, just that I'm not sure) is if the value you overwrite with assigning to the place must be valid, even if it doesn't have a Drop impl.</p>



<a name="204536290"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204536290" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204536290">(Jul 21 2020 at 11:29)</a>:</h4>
<p>It must be an aligned write though. This ties in with the impossibility of creating a raw pointer. You can only do unaligned writes by the method in <code>ptr</code> which requires you to first construct the raw pointer, not only a place expression .</p>



<a name="204893021"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204893021" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204893021">(Jul 24 2020 at 08:56)</a>:</h4>
<p>Indeed Miri does not currently check that references point to "valid data" when being created -- that would be prohibitively expensive (this is one reason why I am arguing for making that not UB any more in the UCG thread linked above). It also currently allows uninitialized integers but I plan to change that (at least with a flag).</p>



<a name="204893192"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204893192" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204893192">(Jul 24 2020 at 08:59)</a>:</h4>
<p>Also <span class="user-mention" data-user-id="116155">@Jake Goulding</span> your original code does not create a reference, from what I can see? As other said, <code>(*ptr).a</code> as a <em>place</em> is fine when <code>ptr</code> is raw, aligned and non-dangling (but what it points to does not matter); turning it into a <em>reference</em> e.g. via <code>ptr::write(&amp;mut (*ptr).a, ...)</code> is where things go wrong because you are creating a reference to an invalid value.</p>



<a name="204893269"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204893269" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204893269">(Jul 24 2020 at 09:00)</a>:</h4>
<p><span class="user-mention silent" data-user-id="229913">HeroicKatora</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct/near/204536199">said</a>:</p>
<blockquote>
<p>The thing where I'm not sure (I didn't say it's not stable, just that I'm not sure) is if the value you overwrite with assigning to the place must be valid, even if it doesn't have a Drop impl.</p>
</blockquote>
<p>yeah I don't think this question is settled. On the MIR level I'd say the old value does not matter at all -- drops are explicit there and when no drop happens, there's nothing even considering the old value.</p>



<a name="204911173"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/204911173" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#204911173">(Jul 24 2020 at 12:53)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct/near/204893192">said</a>:</p>
<blockquote>
<p>your original code does not create a reference, from what I can see? As other said, <code>(*ptr).a</code> as a <em>place</em> is fine when <code>ptr</code> is raw, aligned and non-dangling (but what it points to does not matter); turning it into a <em>reference</em> e.g. via <code>ptr::write(&amp;mut (*ptr).a, ...)</code></p>
</blockquote>
<p>This is my main point of confusion then. I've always heard it as the blanket statement "accessing a field of a struct implicitly creates a reference" and "it's impossible to correctly piece-wise initialize a struct in Rust".</p>
<p>From that, I've extrapolated that <code>uninitialized_struct_pointer.field</code> is summarily wrong in every case.</p>
<p>Instead, it sounds like you <em>can</em> piece-wise initialize a struct, so long as none of the fields implement <code>Drop</code>, which is what allows you to avoid using <code>ptr::write</code> or friends. Is that a better interpretation?</p>



<a name="205110923"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/205110923" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#205110923">(Jul 27 2020 at 12:34)</a>:</h4>
<blockquote>
<p>Instead, it sounds like you can piece-wise initialize a struct, so long as none of the fields implement Drop, which is what allows you to avoid using ptr::write or friends. Is that a better interpretation?</p>
</blockquote>
<p>When discussing MIR semantics, then yes -- this is the more precise / refined version of the blanket statement you mentioned.</p>



<a name="205110959"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/205110959" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#205110959">(Jul 27 2020 at 12:35)</a>:</h4>
<p>(there is another exception btw: if the struct is <code>repr(C)</code> you can compute a raw ptr to the right field "manually" by giving the right offset.)</p>



<a name="205111163"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri%20allows%20accessing%20a%20field%20of%20an%20uninitialized%20struct/near/205111163" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Miri.20allows.20accessing.20a.20field.20of.20an.20uninitialized.20struct.html#205111163">(Jul 27 2020 at 12:37)</a>:</h4>
<p>nothing has been ratified so far about how much we guarantee on the surface level -- IMO we should anyway effectively define our semantics through MIR (or something MIR-like), but even if not it seems reasonable to not attach a validity invariant with place creation, and instead just do that when a reference is being created.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>